CVE-2015-0962

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-18

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/534407Third Party Advisory, US Government Resource
https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/Vendor Advisory
https://techlib.barracuda.com/BWF/UpdateSSLCertsVendor Advisory
https://www.barracuda.com/support/techalertsVendor Advisory
http://www.kb.cert.org/vuls/id/534407Third Party Advisory, US Government Resource
https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/Vendor Advisory
https://techlib.barracuda.com/BWF/UpdateSSLCertsVendor Advisory
https://www.barracuda.com/support/techalertsVendor Advisory

Timeline

Published: May 25, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-09674.3Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML v CVE-2015-09687.5Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code CVE-2015-09695.0SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.CVE-2015-09708.8Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary u CVE-2015-09715.0The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certific CVE-2015-09725.0Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attack CVE-2015-09738.8Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent at CVE-2015-09747.8Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' d CVE-2015-09764.3Cross-site scripting (XSS) vulnerability in Inductive Automation Ignition 7.7.2 allows remote attackers to inject arbitrary web script or HT CVE-2015-097710.0Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2015-09786.9Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-CVE-2015-09799.0Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute